Documentation

MangoApps for ChatGPT

Connect MangoApps to ChatGPT — setup, scopes, tools, Deep Research, security, and admin controls.

At a glance Setup Deep Research For admins Tools Security Troubleshooting

At a glance

Endpoint

https://mcp.iq.mangoapps.com/api/v1/mcp

Protocol

Model Context Protocol (MCP) 2025-06-18, Streamable HTTP transport. Same MCP server used by Anthropic's Claude — there is no separate codebase per AI vendor.

Authentication

OAuth 2.1 with PKCE. ChatGPT supports both Dynamic Client Registration (RFC 7591) and Client ID Metadata Documents (CIMD); MangoApps issues either flavor. The end user signs in to their MangoApps tenant to consent.

Tools available

Up to 885 tools across 80 product domains plus the canonical search and fetch tools required for ChatGPT Deep Research. The actual set surfaced is filtered by (a) the apps your tenant has enabled, (b) the scopes you grant during consent, and (c) your individual access rights inside MangoApps.

Rate limits

5,000 reads/hour per access token. 200 write operations/hour per (connector × tenant). 60 token refreshes/minute per source IP.

Audit

Every tool call recorded with the calling client, the user, the tool, the call latency, and the truncated arguments. Visible to tenant admins at /admin/connectors.

Availability

The MangoApps connector is enabled per-tenant by a MangoApps administrator. It's not gated by pricing tier — trial tenants, design partners, and any customer whose admin has flipped the switch can use it. If you can't authorize the connector, ask your tenant administrator or your MangoApps account team to enable it for your tenant.

Setup

For end users (one-click connect)

In ChatGPT, open Settings → Apps (renamed from Connectors on 2025-12-17).
Find MangoApps in the directory and click Connect. (If you don't see it in the directory yet, choose Add custom and paste https://mcp.iq.mangoapps.com/api/v1/mcp.)
You'll be redirected to a "Which MangoApps tenant?" page. Enter your tenant slug — the part of your MangoApps URL before .workforce.mangoapps.com. For example, if you sign in at acme.workforce.mangoapps.com, enter acme.
Sign in to MangoApps if you're not already.
The consent screen lists every MangoApps domain ChatGPT is requesting access to (Forms, Tasks, etc.). Review and click Authorize.
You're returned to ChatGPT with the connector active. Start a new chat and ask anything — "list my recent form submissions", "summarize last week's surveys", "what's overdue on my OKRs?", or kick off Deep Research over your tenant.

For ChatGPT Desktop / Mac

ChatGPT Desktop on macOS supports remote MCP via the Apps menu — paste the same MCP endpoint URL when prompted. OAuth opens in your default browser; no separate config file required.

Deep Research over your tenant

ChatGPT's Deep Research surface uses an MCP connector's search and fetch tools to crawl across your data and assemble multi-step research reports. MangoApps's connector implements both:

search(query) — Unified ILIKE search across forms, tasks, news-feed posts, Sites pages, and workspace messages. Returns up to ~15 results with typed IDs you can follow up on.
fetch(id) — Retrieve the full body of a single record by its typed ID (e.g., page:12, form:1145, post:7).

Example Deep Research prompts that work well against a MangoApps tenant:

"Audit our remote-work policy: pull every policy doc, training module, and FAQ that mentions remote work, then summarize what's missing or contradictory."
"Compile a Q3 review packet: every News Feed announcement, OKR status update, and Workspace post about the field-team launch."
"Find all forms our HR team owns. Which haven't been updated in 12+ months?"

Deep Research respects every filter: it can only read what the consenting user could read in MangoApps directly, and only across the OAuth scopes granted.

For administrators

Tenant-level controls

Tenant administrators manage every active connector from https://<your-tenant>.workforce.mangoapps.com/admin/connectors:

See who connected — Each row shows the OAuth client (e.g., "ChatGPT"), the user who authorized it, the scopes granted, and the last-used timestamp.
Revoke access — One-click revokes every active token issued to that connector for your tenant.
Audit log — Bottom of the page lists the most recent MCP tool calls (tool name, status, latency).

App-level controls

Disabling a marketplace app in MangoApps automatically removes its tools from the connector's catalog. For example, if your tenant disables the "Sites" app, ChatGPT can no longer list, create, or modify Sites pages even if the user had previously consented to those scopes.

User-level controls

The connector inherits each user's permissions in MangoApps. A user without permission to view payroll data cannot use ChatGPT to view payroll data, regardless of the OAuth scopes granted.

Privilege gate for broad access

The mcp:all_tools scope — which grants ChatGPT access to every domain — can only be authorized by tenant administrators. Non-admin users must request per-domain scopes (read:forms, write:tasks, etc.).

Tools and scopes

The connector exposes 885 tools across 80 product domains plus the canonical search and fetch tools. Each tool declares whether it is read-only or destructive via standard MCP annotations (readOnlyHint, destructiveHint), and ChatGPT surfaces these in the consent screen and tool-call approval dialogs.

Scope naming

Scopes use the pattern read:<domain> and write:<domain> for every product domain that exposes tools. For example:

read:forms — View forms and your submissions
write:forms — Create forms and submit form data
read:tasks / write:tasks — Tasks app
read:reporting — Run reports and view dashboards
mcp:all_tools — Broad access to every domain (admin-only)

The complete scope list is published at /.well-known/oauth-authorization-server on every MangoApps tenant.

Security and privacy

Data boundaries

ChatGPT can access only the data the consenting user could see in MangoApps directly.
Each access token is bound to a single MangoApps tenant. Tokens issued for tenant A cannot read or write tenant B's data.
Tool call inputs and outputs are not used by MangoApps to train AI models, build user profiles, or feed analytics beyond per-tenant usage metering.

Transport and origin

All connections require HTTPS.
The MCP server validates the HTTP Origin header against an allowlist (chatgpt.com, chat.openai.com, openai.com, plus Anthropic's Claude domains and MangoApps tenant subdomains) to defend against DNS-rebinding attacks.
OAuth 2.1 with PKCE (S256 only) prevents authorization-code interception.
Token endpoint, registration endpoint, and tool endpoint each have separate per-IP rate limits.

Once data reaches ChatGPT

When the user invokes a tool, the tool output is returned to ChatGPT's runtime so it can compose a response. From that point, the data is subject to OpenAI's privacy policy: openai.com/policies/privacy-policy and the applicable enterprise/team agreement. MangoApps does not control retention or downstream use by OpenAI.

Audit trail

Every tool call writes an audit record with the tool name, calling client name (e.g., "ChatGPT"), the consenting user, the timestamp, the call latency, and a truncated copy of the call arguments. Audit records are tenant-scoped and accessible only to tenant administrators.

Full privacy policy

See the MangoApps Privacy Policy, specifically the section "AI Assistants and MCP Connectors".

Troubleshooting

"I authorized but ChatGPT says no tools are available"

The most common cause is that your tenant has disabled some or all marketplace apps, so even with broad scopes the catalog is empty. Ask your admin to check /admin/marketplace_apps for app enablement.

"Tool call returns 'not accessible'"

The corresponding app was disabled for your tenant, or your user account is outside the app's visibility group. Ask your tenant administrator.

"Deep Research returned no results"

Deep Research uses our search tool, which ILIKE-matches across forms, tasks, posts, Sites pages, and workspace messages. If you're searching for content in a less-common app (Wikis, Knowledge Base), wait for v2 of the unified search — or use the app-specific tools directly (e.g., list_wikis).

"I want to revoke a connector immediately"

End users: in ChatGPT, open Settings → Apps → MangoApps → Revoke. Tenant admins: from MangoApps, open /admin/connectors, find the application row, click Revoke. Either path invalidates the token immediately.

Contact

Questions, security disclosures, or feedback on the connector.

Product or setup questions: support@mangoapps.com
Security disclosures: security@mangoapps.com
Privacy questions: privacy@mangoapps.com

Using Anthropic's Claude instead? See MangoApps for Claude.